Security audit

Powehi Universal SEO

Security checks across malware telemetry and agentic risk

Overview

This is a broad SEO audit plugin with real local execution, file writing, credential, and third-party API behavior, but the behavior is mostly coherent with its stated purpose and substantially disclosed.

Install only if you are comfortable with a large SEO automation suite that can crawl sites, run a managed Python runtime, write reports/screenshots, install hooks, and use optional third-party APIs. Use the marketplace or git-clone install path rather than pipe-to-shell, review the installed hook behavior, and use revocable least-privilege API keys because extension credentials may be stored in plaintext in ~/.claude/settings.json.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (109)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The document explicitly recommends a pipe-to-shell installation pattern using curl piped directly to bash, even though it acknowledges this is the less safe option. This is dangerous because it encourages immediate execution of remote, mutable code without prior inspection, enabling supply-chain compromise, MITM/proxy tampering, or malicious upstream changes to result in arbitrary code execution on the user's system.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The comment is materially misleading: although credentials are passed to Python via argv, the script also writes those same credentials into ~/.claude/settings.json in plaintext under the MCP server environment. Misleading security comments increase the chance that reviewers or operators underestimate credential exposure and fail to apply compensating controls.

Intent-Code Divergence

Low

Confidence: 98% confidence
Finding: The installer explicitly warns that the API key will be stored in plaintext, then converts a SecureString back to a normal string and persists it in ~/.claude/settings.json. This creates a real credential exposure risk because any local process running as the user, or backup/sync tooling with access to the profile, can read and exfiltrate the key.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The script claims to avoid partial execution on failure, but it performs many persistent writes into ~/.claude before the final runtime setup step is attempted. If the clone, copy, or setup sequence fails mid-install, the user can be left with a partially installed skill, hooks, agents, and scripts that may behave unpredictably or still be invoked later.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill registers a command that can invoke a local Python runtime and pass user-controlled arguments into a local script, which is a real subprocess execution capability. Although it does not use a shell and only routes to a specific runtime.py entrypoint, it still enables local code execution through the agent without any visible restriction on which scripts or workflows that runtime may perform, making this dangerous in a skill context.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The /release-blog workflow is described as automatically generating a blog post, updating sitemap/llms.txt, deploying, and triggering Google indexing, but the skill text does not prominently warn users that this has external publishing and search-engine side effects. In an agent setting, insufficient disclosure around actions that publish content or notify indexing services can lead to unintended public release of content and irreversible operational changes.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The contribution guide asks users to post full terminal error output and analyzed URLs in public GitHub issues without warning that logs and URLs may contain secrets, internal hostnames, tokens, query parameters, or sensitive customer data. In a security-sensitive tool that analyzes user-supplied URLs, this increases the chance of accidental data disclosure through public bug reports.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill explicitly instructs the agent to write multiple files into an orchestrator-provided output_dir and to 'always write both files,' but it does not require confirming the destination, warning the user about file creation, or using safe create/overwrite semantics. In a normal audit workflow this is expected behavior, but if output_dir is mis-scoped, attacker-controlled, or points at sensitive locations, the agent could overwrite files or persist data without the user's awareness.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to write multiple files, including to an orchestrator-provided output directory, but the skill description does not clearly disclose this side effect to the user. This can lead to unexpected filesystem modifications, and if users or orchestrators pass sensitive or shared paths, the skill may overwrite or create files without informed consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly persists SEO analysis artifacts, including baselines, comparisons, URL history, and findings, but does not warn the user that analysis data will be stored. This can create privacy and data-retention risk because queried URLs and page-derived metadata may be saved to SQLite and output files without informed consent, which is especially relevant in multi-tenant or sensitive internal auditing contexts.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to write findings to `output_dir` without any user-facing disclosure in the skill description that it will modify files. While this appears to be normal audit persistence rather than malicious behavior, silent file writes can surprise users, overwrite expected outputs, or be abused if `output_dir` is attacker-controlled or insufficiently validated by the orchestrator.

Missing User Warnings

Low

Confidence: 72% confidence
Finding: The skill instructs writing artifacts into an orchestrator-provided output directory without an explicit user-facing notice that files will be created. In a multi-tool agent environment, silent file creation can surprise users, overwrite expected artifacts, or leak analyzed content into shared workspaces if path handling and consent are not clear.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to persist screenshots, rendered page analysis, and findings to disk without any requirement to obtain user consent, warn about local retention, or limit what content may be captured. Because screenshots can include sensitive page content, authenticated sessions, internal dashboards, or personal data, silent persistence creates a real privacy and data-handling risk rather than a purely cosmetic documentation issue.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The document describes automatic credential detection, external integrations, and conditional spawning of agents based on available access, but does not pair that with clear consent, data-handling, or privacy warnings. In a skill ecosystem, silent discovery of credentials or integrations can lead to unintended access to third-party services and disclosure of sensitive site or account data.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The command documentation states that a full audit may crawl up to 500 pages and generate reports/screenshots, but it does not clearly warn users about network activity, local storage growth, or the possibility of collecting and persisting sensitive page content. In a skill that automates website analysis with parallel sub-agents, that omission can lead to unintended data collection and resource usage, especially when pointed at internal, staging, or sensitive sites.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The image optimization command includes a local-file mode and mentions optimization plus AI IPTC tagging, but it does not explicitly warn that it may modify file contents or embedded metadata. That can cause irreversible changes to user assets, accidental leakage of metadata, or unintentional processing of sensitive local files if users assume the operation is read-only.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The Firecrawl documentation advertises full-site crawling, URL discovery, scraping, and search over crawled content, but lacks any privacy, authorization, or data-retention warning. In this context, that is risky because users may crawl sites containing private, regulated, or copyrighted content, and the extracted material may then be stored, searched, or reused without clear consent boundaries.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation advertises commands that access Google services using user or service-account credentials, but it does not clearly warn that account-linked data may be accessed and transmitted to external Google APIs. This can lead users to expose Search Console, GA4, indexing, or keyword-planner data without informed consent, increasing privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The image-generation command sends prompts and potentially sensitive business content to an external AI provider, but the documentation does not warn users about that transmission. Users may unknowingly submit confidential campaign details, client information, or proprietary content to a third party, creating privacy and compliance exposure.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The Firecrawl commands involve sending target URLs and retrieved page content to an external crawling service, but the documentation omits a warning about this data flow. In environments analyzing private, staging, or client-owned content, that omission can cause unintentional disclosure of non-public URLs and page data to a third party.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The DataForSEO section omits an explicit warning that queries, domains, and analysis targets are sent to a paid third-party service and may incur usage-based charges. This creates both privacy risk and financial risk, since users may unintentionally disclose client targets or trigger billable API calls without clear notice.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation includes a live `curl ... | bash` upgrade command, which executes remote content directly in a shell. Even though the text labels it as a less-safe convenience option, the command remains copy-pasteable and can lead to arbitrary code execution if the remote source, transport path, or referenced branch content is compromised.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The setup guide instructs users to place a live Google AI API key directly into `~/.claude/settings.json` without any warning about plaintext credential storage, file permissions, backups, or key rotation. This increases the chance of accidental disclosure through local compromise, screen sharing, dotfile syncing, or commit mistakes.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script persists a slice of user-provided prompt text to a local JSON ledger without any notice, consent, or opt-out. Prompts often contain sensitive data such as personal information, proprietary business context, or secrets, so storing them on disk can create an unintended privacy exposure if the host is multi-user, backed up, synced, or later inspected by other tools.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script base64-encodes the user-supplied image and sends it to Google's Gemini API, which is an external service. In a local automation/agent context, transmitting user images off-device without an explicit user-facing warning or consent flow creates a real privacy and data-handling risk, especially if users may assume edits are performed locally.

VirusTotal

65/65 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.